Senior Application Security Engineer

We are looking for a Senior Application Security Engineer to reduce security risk across web applications and APIs throughout the software development lifecycle. You will partner closely with engineering teams to assess application security, perform secure design and code reviews, validate and prioritize findings, and drive remediation to closure. This role focuses on practical application security outcomes: identifying real risk, reducing false positives, and helping teams build and ship secure software efficiently. Experience the freedom of remote work from anywhere in Uzbekistan, whether it's the comfort of your home or our modern office in Tashkent. Responsibilities Perform security assessments of web applications, APIs, services, and supporting componentsFacilitate threat modeling and review architectures and technical designs from a security perspectiveConduct secure code reviews and identify vulnerabilities and insecure implementation patternsValidate findings from automated tools, reduce false positives, and prioritize issues based on exploitability and business impactProvide clear, actionable remediation guidance and secure implementation recommendationsTrack findings through remediation and retesting in collaboration with development teamsAdvise teams on authentication, authorization, session management, input validation, data protection, cryptography, secrets handling, and API security controlsContribute to secure SDLC practices, security standards, guidelines, and reusable security patternsCommunicate security risks and recommendations to technical and non-technical stakeholders Requirements Hands-on experience in application security or product securityStrong knowledge of web application and API security, including OWASP Top 10 and common vulnerability classesPractical experience with security assessments, secure design reviews, and/or secure code reviewsUnderstanding of threat modeling and secure software design principlesStrong knowledge of authentication, authorization, session management, input validation, cryptography, secrets handling, and data protectionHands-on experience with one or more application security technologies, such as SAST, DAST, IAST, SCA, or secrets-scanning toolsAbility to validate security findings, distinguish actionable risks from false positives, and prioritize remediationAbility to read and understand code in at least one programming language (e.g., Java, C#, JavaScript/TypeScript, Python, or Go)Familiarity with modern application architectures, APIs, distributed services, and common software development practicesStrong communication skills and the ability to provide practical guidance to engineering teams Nice to have Experience with DevSecOps practices, including integrating application security tools and security gates into CI/CD pipelinesExperience creating or improving secure SDLC processes, security standards, and developer-facing secure coding guidanceFamiliarity with cloud application security concepts (AWS, Microsoft Azure, or Google Cloud)Knowledge of IAM and application identity concepts (SSO, OAuth 2.0, OpenID Connect, SAML)Experience with containers/Kubernetes or Infrastructure as Code security (Terraform and similar)Relevant security certifications (e.g., CSSLP, CISSP) or equivalent practical expertise We offer We connect like-minded people:Delivering innovative solutions to industry leaders, making a global impactEnjoyable working environment, whether it is the vibrant office or the comfort of your own homeOpportunity to work abroad for up to two months per yearRelocation opportunities within our offices in 55+ countriesCorporate and social eventsWe invest in your growth:Leadership development, career advising, soft skills and well-being programsCertifications, including GCP, Azure and AWSUnlimited access to EPAM's internal learning databaseFree English classes with certified teachersDiscounts in local language schools, including offline courses for the Uzbek languageWe cover it all:Monetary bonuses for engaging in the referral programMedical & family care packageFour trust days per year (sick leave without a medical certificate)Discounts for fitness clubs, dance schools and sports programsBenefits package (sports activities, a variety of stores and services) EPAM is global leader in AI transformation engineering and integrated consulting, serving Forbes Global 2000 companies and ambitious startups. With over thirty years of expertise in custom software, product and platform engineering, we empower our clients to become AI-Native enterprises, driving measurable value from innovation and digital investments.